CVE-2023-22799

2023-02-0920:15:11

CWE-1333

CWE-400

hackerone

web.nvd.nist.gov

vulnerability

redos

dos

globalid

nvd

cve-2023-22799

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

39.0%

JSON

A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

Affected configurations

Nvd

Vulners

Node

rubyonrailsglobalidRange0.2.1–1.0.1ruby

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/rails/globalid",
    "versions": [
      {
        "version": "1.0.1",
        "status": "affected"
      }
    ]
  }
]